topic Re: Weird event number for differing time scope in Splunk Search

Weird event number for differing time scope

githubguthub — Sun, 15 Nov 2020 06:12:46 GMT

source="main" service="sales" operation="inquiryV3" port="8443"

In these screenshots, there's no change in the query at all. query is very simple, so something like:

field1="a" field2="b" field3="c"

all are fixed string, no weird syntax or variable at all, completely basic field-based search

all searches always start on 29 okt 12AM and we're only interested in 29 okt 12AM bar.

first search covers until EOD (23:59:59) 29 okt, yields 703 events

second one covers till EOD 30 okt, yields 752

third is till EOD 31 okt, yields 580

and last one, EOD 1 Nov, yields 642

How is this possible? what am I missing here?

Thanks in advance

Re: Weird event number for differing time scope

ITWhisperer — Sat, 14 Nov 2020 09:36:35 GMT

Insufficient information. Please provide the queries for these charts. I noticed that the overall shapes are subtly different so it is not just about the number of the first bar.

Re: Weird event number for differing time scope

githubguthub — Sat, 14 Nov 2020 14:41:46 GMT

Thanks for the reply @ITWhisperer

source="main" service="sales" operation="inquiryV3" port="8443"

this is the query used in searches

Re: Weird event number for differing time scope

nwuest — Sun, 15 Nov 2020 01:07:01 GMT

Hi @githubguthub,

To follow @ITWhisperer’s sentiment, is there a way you could provide the results with the search query so we can see the diffferences with each search?
It’s not a lot to go off of with just screenshots of the results but no query.

We definitely look forward to hearing back from you so we can help troubleshoot further!

V/R,
nwuest

Re: Weird event number for differing time scope

githubguthub — Sun, 15 Nov 2020 06:09:35 GMT

@nwuest

Hi, this is the query

source="main" service="sales" operation="inquiryV3" port="8443"

beyond that, I'm only tweaking with the time scope :

search 1 --> 29 okt Start of Day (12AM) - 29 okt EOD (23:59:59)

search 2 --> 29 okt 12AM - 30 okt EOD

3 --> 29 okt 12AM - 31 okt EOD

4 --> 29 okt 12AM - 1 Nov EOD

Please let me know if you need anything else

Re: Weird event number for differing time scope

nwuest — Sun, 15 Nov 2020 06:52:05 GMT

Hi @githubguthub,

I was mainly speaking to getting a screenshot of the query AND results.
It would just help us to see what you are looking at specifically in relation with the search and results.

I have yet to find/have a similar instance in Splunk where the search results are going lower with a larger search window so I'm genuinely interested in your challenge.

Hope to hear from you soon!

V/R,
nwuest